CVE-2026-35143
LowCVSS 3.0Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The vulnerability in HCL DFXAnalytics is due to the missing SameSite attribute on session cookies generated during authentication. This could allow a remote attacker to perform Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
Risk Assessment
The risk involves the possibility of executing unauthorized actions within the context of an authenticated user's session, potentially leading to data confidentiality and integrity breaches in the organization.
Recommendation
It is recommended to set the SameSite attribute on session cookies and implement additional CSRF protection mechanisms, such as Anti-CSRF tokens.
Original NVD description (English source)
HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.